OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-109272

LOW · CVSS 3.7 Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-10-12 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

ImageMagick versions prior to 7.1.2-32 are vulnerable to a NULL pointer dereference in the PostScript decoder, which can be exploited by attackers using specially crafted PostScript files to crash the application, resulting in a denial of service. Organizations utilizing ImageMagick for image processing should prioritize updating to the latest version to mitigate this risk, particularly those with exposure to untrusted input.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-109272
Severity
LOW
CVSS
3.7
EPSS
N/A

Original NVD Description

ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service.